Gameguru Mania

[heretic]

Windows NTFS has a long-standing feature called Alternate Data Streams (ADS) that lets a single file carry hidden extra data.

A normal text file can look completely clean in File Explorer and still contain secret notes, scripts, or malware payloads that most users never notice.

Attackers have used this technique for years to hide malicious code (tracked as MITRE ATT&CK T1564.004).

Legitimate uses also exist — the most common is the “Zone.Identifier” stream that marks files downloaded from the internet.

To check any file for hidden streams, run this PowerShell command:
Get-Item .\filename -Stream *